T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.en.md:32
- Finding
- Unpinned Remote Repository Retrieval and npm Script Execution## Vulnerability Details **File Location**: `SKILL.en.md`, lines 32–34 **Additional Location**: `SKILL.md`, lines 29–31 **Vulnerability Type**: Unverified remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash git clone https://github.com/dongsheng123132/2origin.git cd 2origin npm run verify # 96 self-test assertions + 25 MCP end-to-end + mutation check 19/19 ``` The equivalent instructions in `SKILL.md` are: ```bash git clone https://github.com/dongsheng123132/2origin.git cd 2origin npm run verify # 自测 96 项 + MCP 端到端 25 项 + 变异检查 19/19 ``` ### Technical Analysis The installation instructions clone the current state of a remotely controlled Git repository and immediately invoke an npm script from it. They do not pin an immutable commit, verify a cryptographic digest or signature, or otherwise establish that the downloaded code is the same code that was reviewed. An npm script can execute arbitrary operating-system commands under the invoking user's account. Consequently, the effective executable payload is controlled by the repository state at the time the instructions are followed rather than by the audited Skill package. The repository owner—or an attacker who compromises the repository or its owner account—could modify `package.json`, the verification scripts, or code reached by those scripts after the Skill has been reviewed. The implementation referenced by these commands is not included in the audited project, which contains only `SKILL.md` and `SKILL.en.md`. Its behavior and the documentation's security claims therefore could not be independently verified in this audit. The separate `npm run verify` commands at `SKILL.en.md:125` and `SKILL.md:114` repeat the execution risk after installation, but they do not independently retrieve the payload. ### Attack Path 1. An attacker gains control of the referenced GitHub repository or the repository owner's account, or the owner maliciously changes the reposito ...[truncated 1133 chars]
- Remediation
- ## Remediation Suggestions 1. Bundle the reviewed implementation directly with the Skill so the distributed documentation and executable code are audited as one immutable unit. 2. If remote retrieval is necessary, pin the clone to a specific reviewed commit rather than executing the repository's default branch: ```bash git clone https://github.com/dongsheng123132/2origin.git cd 2origin git checkout --detach EXPECTED_COMMIT_SHA ``` 3. Verify the downloaded content against a separately published cryptographic checksum or a trusted signed Git tag before running any script. 4. Document the exact approved commit, expected digest, verification procedure, and signer identity. 5. Inspect the pinned `package.json` and the complete transitive command path behind `npm run verify` as part of the release audit. 6. Run verification in a sandbox or disposable container with no secrets, restricted filesystem access, minimal privileges, and denied network access unless explicitly required. 7. Apply the same pinned-version and integrity-verification requirements to every later invocation of `npm run verify`. 8. Update both language versions of the documentation consistently.